ruby-core

In the context of making a Ruby cgi script that generates a PDF using the
Ruby library PDF::Writer, I ran into an odd problem where the script ran
fine from the command line but failed when run in the WWW server. The longer
story is in the forwarded message below. PDF::Writer uses this idiom to find
.tfm files that are stored in the same tree as the Ruby library:
METRICS_PATH = [ File.join(File.dirname(File.expand_path(__FILE__)),
'fonts') ]
File.expand_path taints its return, and this causes METRICS_PATH to be nil
and PDF::Writer to fail.

I am not a Ruby guru, but it seems to me very unintuitive that Ruby taints
this result when it doesn't seem to depend on the value of any environment
variables. The description of the operator implies that it should only use
environment variables if a ~ appears in the string.

Thanks for a great language,

Tom Epperly

---------- Forwarded message ----------
From: Tom Epperly <[email protected]>
Date: Mon, Apr 6, 2009 at 12:15 PM
Subject: Suggestions/issues for Ruby PDF::Writer
To: [email protected]


By the way, PDF::Writer is very cool. I am using it to make a program to
generate azimuthal maps for amateur radio. I am trying to create a WWW front
end for it, but I am have to set $SAFE to 0 apparently because of
line 13 in pdf/writer/fontmetrics.rb.
 METRICS_PATH = [ File.join(File.dirname(File.expand_path(__FILE__)),
'fonts') ]
The results of File.expand_path(__FILE__) is considered tainted. This
ultimately causes the METRICS_PATH to be [ nil ].

This simple program demonstrates the problem:
#!/usr/bin/env ruby
require 'pdf/writer'
$SAFE = 1
pdf = PDF::Writer.new(:paper => "LETTER")
pdf.text("Hello world")
pdf.save_as("foo.pdf")

% ruby foo.rb
/usr/lib/ruby/1.8/pdf/writer.rb:794:in `load_font': private method `sub'
called for nil:NilClass (NoMethodError)
       from /usr/lib/ruby/1.8/pdf/writer.rb:1005:in `select_font'
       from /usr/lib/ruby/1.8/pdf/writer.rb:1067:in `font_height'
       from /usr/lib/ruby/1.8/pdf/writer.rb:2401:in `text'
       from foo.rb:5

This second example demonstrates where the tainting occurs. I am not sure
why expand_path taints its result, but it apparently does.

#!/usr/bin/env ruby
file = __FILE__
print file + "\n"
print "Is tainted? " + file.tainted?.to_s + "\n"
path = File.expand_path(file)
print path + "\n"
print "Is tainted? " + path.tainted?.to_s + "\n"
dirname = File.dirname(path)
print dirname + "\n"
print "Is tainted? " + dirname.tainted?.to_s + "\n"
fdir = File.join(dirname, 'fonts')
print  fdir + "\n"
print "Is tainted? " + fdir.tainted?.to_s + "\n"
print File.exists?(File.join(fdir,
                            "Times-Roman.afm")).to_s + "\n"

% ruby -T1 foo2.rb
foo2.rb
Is tainted? false
/tmp/foo2.rb
Is tainted? true
/tmp
Is tainted? true
/tmp/fonts
Is tainted? true
foo2.rb:15:in `exists?': Insecure operation - exists? (SecurityError)
       from foo2.rb:15


It would be nice if PDF::Writer could work with arbitrary values of $SAFE.

It would also be nice if there was a way that I could set up a circular
clipping path.

Tom

Thread

Prev Next

In This Thread

Prev Next